Posted
by
CmdrTacoon Monday August 03, 2009 @12:19PM
from the don't-leave-me-daddy dept.

darthcamaro writes "Remember Conficker? April first doom and gloom and all? Well apparently after infecting over five million IP addresses, it's now an autonomous botnet working on its own without any master command and control. Speaking at the Black Hat/Defcon Hat security conference in Las Vegas, Mikko Hypponen, chief research officer at security firm F-Secure, was told not to talk in detail about the Conficker gang — the problem is that not all researchers were under the same gag order. Just ask Roel Schouwenberg, senior anti-virus researcher at security firm Kaspersky, who says 'The Conficker botnet is autonomous; that is very strange in itself that they made Conficker replicate by itself. Now it seems like the authors have abandoned the project, but because it is autonomous, it can do whatever it wants and it keeps on trying to find new hosts to infect.'"

Watch the series again. S.A.C. has nothing to do with a virus becoming self aware. It's actually a collective of individuals who believe to be acting autonomously but, in reality, are all following a pattern mimicking individual intent by a single entity.

The Laughing Man was originally a single hacker, but once he stopped his activities, a group of others took it from there and their actions collectively created another Laughing Man.

It's basically digital gestalt-ism combined with neural networking where each human is a node in the larger network without being aware of the whole.

The virus was the original, and it was quite badass according to the world. But before it could accomplish whatever goals its creators had in mind, copycats came up and used it for other purposes (research, DDOS, etc).

In reality the creator hasn't been utilizing it, because the rest of the world has been hijacking it for their own purposes, and the original intent of the virus will most likely never be known to the public.

So I called Symantec about it and the technician I got on the phone explained me that since Metasploit was a legitimate penetration testing tool, it was whitelisted.

Of course I got angry and tried to explain that even if it might have its legitimate purposes, there still was the concern that any worm author could simply take the Metasploit code and embed it in his own creation.

The Symantec employee then told me that he was not aware of a single instance where such a thing would ever have happened, not in his entire career as an AV expert. Back then on the phone with the Symantec guy I had no internet access with me but told him that I was pretty confident that this has very well happened in the past.

So shortly after the phone call I googled a bit and in an instant found that Conficker itself uses the Metasploit MS08-067 code!

So I wrote that to Symantec and they did answer me the following(paraphrased): Symantecs Proactive Threat Detection (aka HIPS) is not designed to prevent the exploitation of unpatched services, I should instead apply the patch...

Well... they revised their opinion after I asked for the official permission to publish those hilarious statements which I have done hereby anyhow:-)

Scary, isn't it? But nah, Symantec did not write Conficker.

Oh, and a few days later they detected and prevented the Metasploit attack.

p.s. I am writing as AC not because Symantec could know who I am, they can find that out anyways. I am writing as AC so Symantec does not get to correlate my real name with my SlashDot account.

Not as impossible and funny as it might appear. Imagine a HD crash and no backup of the keys to issue new commands.:)

But it could just as well be kept dormant 'til it's out of the news... if Sasser taught us anything, it's that self replicating aggressive worms WILL survive and continue to pose a threat, even years after the last version has been found by every AV tool.

Buying a new keyboard is moot if your keys are gone. Besides, I do fine without one, I just put my key on my underwear and that's how I find it again, and NOBODY else would willingly dig through that so they're safe too!

Wait... I need to run out and patent the niche market missed in this patent. I'll make millions in lawsuits!

Abstract

A method of swing on a swing is disclosed, in which a user positioned on a standard swing suspended by two ropes from a substantially horizontal bar other than a tree induces side to side motion by pulling alternately on one rope and then the other.

that actually makes a hell of a lot more sense than someone just saying "I'm bored, let's do something else" and giving a 5 million computer botnet up. I mean come on, what are they, insane?! That's like the computer criminal version of buying a buying an italian sports car and then driving it into a lake on purpose. You just don't do that once you finally have one. This article is just stupid beyond words! There is no way in hell it was just "given up." The person behind it either died or is feeling

that actually makes a hell of a lot more sense than someone just saying "I'm bored, let's do something else" and giving a 5 million computer botnet up. I mean come on, what are they, insane?! That's like the computer criminal version of buying a buying an italian sports car and then driving it into a lake on purpose. You just don't do that once you finally have one. This article is just stupid beyond words! There is no way in hell it was just "given up." The person behind it either died or is feeling some serious heat from people trying to catch them.

This shows an immense failure of imagination. Just off the top of my head, maybe the developed something better. Maybe they've found something more profitable to do. If you spend more than two seconds, I'm sure you too can think of other alternatives. And you're apparently calling it "insane" and/or "immensely stupid" to not fall for the sunk costs fallacy. It doesn't matter how much time or effort they sunk into it making it. If the continued costs of running that car are too much, if you aren't a vi

In Soviet Union, you are being walked away....
All this assumes the authors voluntarily left the network alone, it's also quite feasible that one of the 5 million "pwned" took decisive action, or that they just got pulled over with 2 pounds of weed and are taking an extended state sponsored vacation.

7) Feds are monitoring connections to the bot net and attempts to master connect to it will be traced.Also even if the Feds didn't create it, I'm sure we they have figured it out to the point that it certainly can be controlled by our government.

3. "And in the contest between Y and Z, the winner is... The current office holder, X, by a landslide write-in vote!" I think people would notice that. Which makes me wonder, does Bart Simpson still get a good write-in following?

4 sounds the most likely. As I recall from reading about the worm, it uses several layers of protection to identify the controller. A hard drive crash might cause the author to lose the private key, at which point no one can control the botnet without first breaking AES.

6. The confikkr botnet shows more or less the same behaviour taht the US, russian etc nuclear armadas display: growing constantly, but besides that not much action.This is not a coincidence. The botnet exists for the very same reason - to counterbalance some other governments cyber warfare structures.

from any other virus? Last I checked, any effective virus has a mechanism to spread/replicate by itself, whether to other IPs on the same subnet or via AIM or USB drives or what have you.
In April and may I scanned my network of ~8500 completely user-controlled machines and found a grand total of 4 confirmed infected. The IRC bots spread via AIM links were more prevalent.

Would you call a missile a hybrid? It has a delivery system (thruster, guidance system, etc) and a payload (explodie part). You can replace that explodie part with a nuclear, biological, or chemical warhead... or with a satellite that you use that ICBM launch system to put into low earth orbit.

Have there been any relevant arrests recently? Maybe the controllers are behind bars or otherwise caught up in real-life problems. Maybe they decided the worm got a little too well known and thought better of trying to do anything with it for fear of getting caught.

When enough users have been lulled into inaction and enough machines have been taken over, the enemy will strike.
Meanwhile, the operators may be sending commands to specific PCs of interest. Security researchers might not be picking up commands targeted to only a few machines.

Most anti-virus defense efforts assume the enemy is only marginally competent and has no strategic goal. It's clear from what's known about the Conflicker attack that the enemy is significantly more competent and better funded than those behind previous viruses. The Conflicker attack was updated frequently until it was deploying itself successfully despite defensive efforts. Once the attack continued to grow despite defensive efforts, the updates stopped. That's not loss of interest, that's operational art.

Actually, most AV researchers do take their "enemies" serious. Malware writers are competent. If only because they manage to use security holes which require quite a bit of intimate knowledge of the machines (and the OS) you try to infect.

It's not a secret that most malware writers do have a goal by now: Money. The days of the pimple-faced kiddy sitting in the basement and, out of frustration of not getting laid, releasing some worm on the world. That's so 90s.

What's right is that AV research usually targets the "mass market", at least when it comes to AV development. If you're working for strategic targets, you usually can't make a big speech out of it, neither military nor government nor financial services like you blabbing about how insecure their setup is. So any commands issued only to a small subset of the botnet would probably go unnoticed.

While we're pissing in the wind anyway, allow me to add mine: How about this whole deal being a targeted attack, and they just waited for their designated target becoming infected.

Have there been any new worm enabling Windows vulnerabilities disclosed since Conficker was first noticed? Looking around a little, there have been more non-worm remote exploits than I care to sort through; the worm/non-worm distinction I am drawing is that a worm enabling vulnerability doesn't require any action on the client.

I could of swore (correct me if I'm wrong) that conficker's instruction set usually downloaded encrypted instructions from certain web servers. Certainly it's possible that they lost control of it instead of abandoned it. (Not in the skynet way) I could imagine that if instructions weren't sent past a point in time, that the encryption it used was wrong, or possibly even corrupted at some point.

The idea with conficker was that it would generate thousands of websites and contact them for payload instructions. The security community registered a lot of these sites in advance, so it may be the case that these things are always trying to phone home but no one is answering.

I also imagine that ISPs are blocking connections to servers they have identified as conficker controllers.

My understanding is that theres some p2p aspect too, but it may not be operational. Heck, getting legitimate p2p working on a residential connection is a pain, let alone a known illegitimate one. Again, Im guessing most ISPs are blocking this somehow.

So the botnet may be up and running, but it cannot contact its masters. Eventually these PCs will be replaced or reimaged and conficker will be a statistical blimp a year from now.

It will go away on its own some day. We got rid of most Windows 3.11 computers, we'll get rid of most Windows XP computers, etc. It will run out of food soon and a bot-net that can't adapt its self (lucky us, huh?) to other operating systems will go away. We still have Blaster and some of its friends, but maybe the people that do deserve it, because 100% backwards compatibility is a PITA for software engineers. Maybe we should leave Conflicker where it is for the sake of software evolution.

Then I suppose we should be expecting a new virus/botnet to be built soon. So that they can hack the key to the old botnet:)And if they attach pretty screensaver showing computations in real time, users probably will sign up voluntarily

Because today, my dream of a bot model that can infect all known botnets became true!I call them lolbots, because of the fun I will have with them, because In Ex Soviet Russia, botnets are attacked by ME!

Now go forth my little botsies. And if they do not sing our song... blow them into little bits... *sings a children's melody* Mmmm. Mmhh-*hmmm* mmmhh hmm-mmm

Yeah, a justifiable reason to act this way would be to limit the amount of information that the botnet authors gain access to regarding ongoing criminal investigations, etc. The idea being that if they know that you know they're somewhere in Russia, they can/will move so you can't catch them.

... Mikko Hypponen, chief research officer at security firm F-Secure was told not to talk in detail about the Conficker gang...

Ok, what could possibly be the reason for this? I can only think of one, which is simply an effort to keep the malware alive (even though it's "dead") in order to scare users into buying their software for protection they don't need, and until someone provides another probable motive I'll discourage anybody to use F-Secure.

The same reason I'd mow the lawn of a vacant house next door or get its broken window fixed: To make it look lived-in. I don't want homeless squatters moving in, defecating all over, stealing from people in the neighborhood, and eventually burning the house down.

Of course, you knew that some malware will patch their host to retain exclusive access by preventing infection by other malware, right? Depending on what the "few petty IRC-bot infections" consisted of, you may have had a reasonably well inoculated machine protected by someone with an active interest in preventing further infections, especially against well-publicized vectors as were contained in conficker.